Dangerous Deviation Detection: Catching the Agent Action Nobody Asked For

Check Point's 2026 Cloud Security Report found that 78 percent of organizations reported a confirmed or suspected AI-related security incident in the past year, according to a Check Point blog post introducing Dangerous Deviation Detection. The approach checks each agent tool call before it runs, addressing cases where an agent takes an unrequested action that deletes data, leaks it, or widens access — a gap Check Point says permissions and prompt screening miss because least privilege cannot remove access a job needs and prompt attack detection screens inputs rather than the action itself.